67 lines
2.3 KiB
Text
67 lines
2.3 KiB
Text
|
#!/usr/bin/env bash
|
||
|
|
set -euo pipefail
|
||
|
|
|
||
|
|
root="$(cd "$(dirname "$0")/.." && pwd)"
|
||
|
|
containerfile="$root/tools/container/Containerfile"
|
||
|
|
|
||
|
|
fail() {
|
||
|
|
printf 'build: %s\n' "$*" >&2
|
||
|
|
exit 1
|
||
|
|
}
|
||
|
|
|
||
|
|
if [[ "${1:-}" == --inside-container && $# -eq 1 ]]; then
|
||
|
|
[[ "${LAZARET_BUILD_CONTAINER:-}" == 1 ]] || fail 'container marker is absent'
|
||
|
|
cd "$root"
|
||
|
|
tools/materialize-fuser
|
||
|
|
tools/materialize-runsc --build
|
||
|
|
cargo build \
|
||
|
|
--release \
|
||
|
|
--locked \
|
||
|
|
--package lazaret-client \
|
||
|
|
--package lazaret-host-coordinator \
|
||
|
|
--package lazaret-escalation-client \
|
||
|
|
--bins
|
||
|
|
env RUSTFLAGS="-C relocation-model=static -C link-arg=-no-pie" cargo build \
|
||
|
|
--release \
|
||
|
|
--locked \
|
||
|
|
--target x86_64-unknown-linux-musl \
|
||
|
|
--package lazaret-sandbox-init \
|
||
|
|
--bin lazaret-sandbox-init
|
||
|
|
sandbox_init="$CARGO_TARGET_DIR/x86_64-unknown-linux-musl/release/lazaret-sandbox-init"
|
||
|
|
if readelf -l "$sandbox_init" | grep -q 'Requesting program interpreter' ||
|
||
|
|
! readelf -d "$sandbox_init" 2>&1 | grep -q 'There is no dynamic section'; then
|
||
|
|
fail 'sandbox init is dynamically linked'
|
||
|
|
fi
|
||
|
|
exit 0
|
||
|
|
elif [[ $# -ne 0 ]]; then
|
||
|
|
printf '%s\n' 'usage: tools/build' >&2
|
||
|
|
exit 2
|
||
|
|
fi
|
||
|
|
|
||
|
|
for command in nerdctl sha256sum; do
|
||
|
|
command -v "$command" >/dev/null 2>&1 || fail "$command is required"
|
||
|
|
done
|
||
|
|
|
||
|
|
mkdir -p "$root/.lazaret"
|
||
|
|
containerfile_digest="$(sha256sum "$containerfile")"
|
||
|
|
containerfile_digest="${containerfile_digest%% *}"
|
||
|
|
image="localhost/lazaret-builder:${containerfile_digest:0:16}"
|
||
|
|
proxy_options=()
|
||
|
|
for variable in ALL_PROXY HTTP_PROXY HTTPS_PROXY NO_PROXY all_proxy http_proxy https_proxy no_proxy; do
|
||
|
|
if [[ -v $variable ]]; then
|
||
|
|
proxy_options+=(--env "$variable")
|
||
|
|
fi
|
||
|
|
done
|
||
|
|
nerdctl build --tag "$image" --file "$containerfile" "$root/tools/container"
|
||
|
|
nerdctl run --rm \
|
||
|
|
--mount "type=bind,src=$root,dst=/workspace,ro" \
|
||
|
|
--mount "type=bind,src=$root/.lazaret,dst=/workspace/.lazaret" \
|
||
|
|
--workdir /workspace \
|
||
|
|
--env CARGO_HOME=/workspace/.lazaret/cache/cargo \
|
||
|
|
--env CARGO_TARGET_DIR=/workspace/.lazaret/target \
|
||
|
|
--env GIT_CEILING_DIRECTORIES=/workspace \
|
||
|
|
--env HOME=/workspace/.lazaret/home \
|
||
|
|
--env LAZARET_BUILD_CONTAINER=1 \
|
||
|
|
"${proxy_options[@]}" \
|
||
|
|
"$image" \
|
||
|
|
tools/build --inside-container
|